Retention is chosen by disk space and then never revisited. The right question is different: how long could something be wrong before anybody notices? Every copy older than that is what saves you, and a seven-day window covers almost none of it.

What short retention misses

  • A compromise that began three weeks ago - every copy you hold contains it.
  • A table quietly emptied by a bad migration that nobody opened until month end.
  • Content deleted in April and needed for an audit in November.
  • A slow corruption that has been written into every backup since it started.

A schedule that covers all of it

restic forget \
  --keep-hourly 24 \
  --keep-daily 14 \
  --keep-weekly 8 \
  --keep-monthly 12 \
  --keep-yearly 3 \
  --prune

It costs far less than it looks. Deduplicated backups of a site that changes slowly store one copy of the unchanged parts, so a year of monthly snapshots is often a few percent more than one.

The rule of thumb

  • Hourly for a day - the mistake you made this morning.
  • Daily for two weeks - the one somebody reports on Monday.
  • Weekly for two months - the one found at month end.
  • Monthly for a year - compromise, audit, and the slow corruption.

Retention is also a legal question

Backups contain personal data. If a customer asks to be deleted, they are still in every backup until it expires - so a defined retention period is part of the answer, and an unlimited one means you can never honestly say the data is gone.

Prune on a schedule, and watch that it runs

A forget policy that never runs fills the disk, and a full backup disk means no new backups - which is discovered on the day it matters. See reading a failed backup log.